Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.

Awesome Lists | Featured Topics | Projects

https://github.com/NetSPI/MicroBurst

A collection of scripts for assessing Microsoft Azure security
https://github.com/NetSPI/MicroBurst

Last synced: 7 days ago
JSON representation

A collection of scripts for assessing Microsoft Azure security

Awesome Lists containing this project

README 

        
![MicroBurstLogo](https://notpayloads.blob.core.windows.net/images/Microburst_Github.png) 


 

[![licence badge]][licence] 

[![stars badge]][stars] 

[![forks badge]][forks] 

[![issues badge]][issues]

![Twitter Follow](https://img.shields.io/twitter/follow/kfosaaen.svg?style=social)



[licence badge]:https://img.shields.io/badge/license-New%20BSD-blue.svg

[stars badge]:https://img.shields.io/github/stars/NetSPI/MicroBurst.svg

[forks badge]:https://img.shields.io/github/forks/NetSPI/MicroBurst.svg

[issues badge]:https://img.shields.io/github/issues/NetSPI/MicroBurst.svg



[licence]:https://github.com/NetSPI/MicroBurst/blob/master/LICENSE.txt

[stars]:https://github.com/NetSPI/MicroBurst/stargazers

[forks]:https://github.com/NetSPI/MicroBurst/network

[issues]:https://github.com/NetSPI/MicroBurst/issues



### MicroBurst: A PowerShell Toolkit for Attacking Azure



MicroBurst includes functions and scripts that support Azure Services discovery, weak configuration auditing, and post exploitation actions such as credential dumping. It is intended to be used during penetration tests where Azure is in use.



### Author, Contributors, and License

* Author: Karl Fosaaen ([@kfosaaen](https://twitter.com/kfosaaen)), NetSPI

* Contributors: 

	* Scott Sutherland ([@_nullbind](https://twitter.com/_nullbind))

	* Thomas Elling ([@thomaselling](https://twitter.com/thomas_elling))

	* Jake Karnes ([@jakekarnes42](https://twitter.com/jakekarnes42))

	* Josh Magri ([@passthehashbrwn](https://twitter.com/passthehashbrwn))

* License: BSD 3-Clause

* Required Dependencies: Az, Azure, AzureRM, AzureAD, and MSOnline PowerShell Modules are all used in different scripts

* Dependencies Note: Originally written with the AzureRM PS modules, older scripts have been ported to their newer Az equivalents

* Platform Note: These scripts will only run on a Windows-based platform.



### Importing the Module / Usage

	PS C:> Import-Module .\MicroBurst.psm1

This will import all applicable functions based off of the currently installed modules in your environment. The scripts can then be invoked using their names like

```

PS C:> Get-AzDomainInfo

```



If you want to simplify the trusting of the code files, use the following "Unblock-File" command to recursively trust each of the downloaded files:



	PS C:> dir -Recurse .\MicroBurst-master | Unblock-File



Recommended Modules to install:

* Az

* AzureAd

* MSOnline



Here's how a module can be installed in Powershell

```

PS C:> Install-Module 

```

### Scripts Information

If you want to learn what a specific script does use `Get-Help` with script name like:

```

PS C:> Get-Help Invoke-EnumerateAzureSubDomains

```



### Related Blogs

* A Beginners Guide to Gathering Azure Passwords

* Anonymously Enumerating Azure Services

* Anonymously Enumerating Azure File Resources

* Get-AzurePasswords: Exporting Azure RunAs Certificates for Persistence

* Using Azure Automation Accounts to Access Key Vaults

* Running PowerShell on Azure VMs at Scale

* Maintaining Azure Persistence via Automation Accounts

* Decrypting Azure VM Extension Settings with Get-AzureVMExtensionSettings

* Attacking Azure with Custom Script Extensions

* Lateral Movement in Azure App Services

* Get-AzPasswords: Encrypting Automation Password Data

* Azure Privilege Escalation Using Managed Identities

* Azure Persistence with Desired State Configurations

* How To Extract Credentials from Azure Kubernetes Service (AKS)

* Extracting Managed Identity Certificates from the Azure Arc Service



### Presentations

* Extracting all the Azure Passwords - DEF CON 29 - Cloud Village

  - Slides

* Adventures in Azure Privilege Escalation - DerbyCon 9

  - DerbyCon 9 (2019) Slides

* Attacking Azure Environments with PowerShell - DerbyCon 8

  - DerbyCon 8 (2018) Slides

  - BSidesPDX (2018) Slides

	

### Wiki Information

Check out the [MicroBurst Wiki](https://github.com/NetSPI/MicroBurst/wiki) for more information on the usage of the toolkit and the available functions.